Home / Vaults / Agentic Browser Isolation
Agentic Browser Isolation
A living risk graph for one narrow, consequential question: when an AI agent browses and acts on the web, does it run inside your browser with your logged-in sessions, or inside an isolated browser with a scoped identity of its own?
Read key:
sgit_rk1_92cad4cea8f58c55f59b686c71c935225a1ba7c41ecb6922a8aa570467604f6e:0610gsp9In the official UI: open it read-only in a new tab · From the CLI:
sgit clone sgit_rk1_92cad4cea8f58c55f59b686c71c935225a1ba7c41ecb6922a8aa570467604f6e:0610gsp9Published deliberately, and derived: the owner supplied a vault key, our intake check refused it for publication, and only this one-way derivation appears here.
See it live, here
Both surfaces open automatically below. You can also open the app in its own window ↗ — with ten pages to walk, it is worth the room.
What is going on here, step by step
Four things worth stopping on. Every screenshot is of this vault, driven by a script holding nothing but the published read key.
One vault, seventeen entry points
The app opens on Facts and carries a numbered spine across the top: your reality, the two designs, the chain, how it unfolds, stakeholders, an explorer, two graph views and the raw data. Seventeen HTML entry points in one vault, each a real page.
The evidence is cited outward, too — the facts link to Brave's prompt-injection write-up, an arXiv paper on credential exposure, independent testing. A risk register that names its sources is one you can argue with.
The same exposure, in seven languages
This is the idea worth stealing. Every altitude has one named owner — L1 IT, L2 CISO, L3 DPO/CFO/COO, L4 CEO, L5 Board — and each owns the risk in their own language.
A risk is never assigned automatically. It sits pending until that owner accepts it personally, and only an accepted risk escalates to the altitude above. Look at the counts in the picture: IT has 5 risks pending; everyone above is waiting, with nothing yet arrived — because nothing has been passed up. There is no deny button: accept, mitigate, or ask for more data.
The register is data, and you can see it as one
Seventy JSON files hold the register — risks, controls, evidence, owners, acceptances — and the app offers them as an explorer, a rendered graph, and a queryable graph database, with RDF tooling vendored into the vault so none of it needs the network.
That is the shape argument for vaults holding structured analysis rather than prose: the same encrypted objects serve a narrative page, a stakeholder view and a graph query, because the underlying thing is data.
An app that asks for nothing
Its app.json declares fs.read: true and fs.write: [] — an empty write list. Compare the Supplement Stack, which writes to one folder, and Risk Mandate, which uses an LLM without holding its key.
Three vaults, three points on the same scale, each declared in the vault rather than configured on a server. The footer states the consequence plainly: your changes are device-local; the vault baseline is never modified.
What this vault demonstrates
| Feature | How this vault uses it |
|---|---|
| Seventeen entry points | The most in the catalogue: a narrative spine, a page per stakeholder altitude, an explorer, two graph views and the raw data — one encrypted store, many front doors |
| Zero write capability | fs.write: []. The app reads and renders; edits stay device-local and the vault baseline is untouched |
| Structured analysis, not prose | ~70 JSON files hold risks, controls, evidence and acceptances; the pages are views over that data |
| Graph tooling inside the vault | RDF libraries vendored in, so the explorer and graph database work with no network and no CDN — the authoring contract making offline the default |
| Cited evidence | Facts link out to primary sources; the register can be checked rather than believed |
| A mechanism, not a spreadsheet | Acceptance-gated escalation with named owners and no deny button — the part most worth copying |
The audit, honestly
Audited across all 104 files before the key was published. Clean: no credentials, no personal data, no operational bookkeeping, and the vault's own key does not appear in its content.
The scan produced six hits and all six were false positives — digit runs like 0123456789 inside a minified RDF library, matching a phone-number pattern. Worth recording because it is what a real audit looks like: the interesting output of a secret scanner is usually the part you have to rule out by reading it.
As always: revocation is not retroactive. Anyone who fetches these objects keeps them.
Derived facts
104 files · 2.4 MB · 4 commits · seventeen app entries · last updated 2026-07-18 — derived from the read key alone by admin/build/catalogue_derive.py, the same derivation that populates the catalogue.